Hi All,
I have dashboard displaying list of groups asset counts for various business units and recently has some one requested some set of ip ranges need to be excluded. But problem is if am using ...
See more...
Hi All,
I have dashboard displaying list of groups asset counts for various business units and recently has some one requested some set of ip ranges need to be excluded. But problem is if am using eg NOT (IP="10.0.0.0/8") in my base search this is affecting other group asset count for all other BU as overlap of same subnet range.
How can i create search query to make this exclusion for specific group/BU wise, instead of applying for all group/BU.
my current search looks something like this,
index=something sourcetype=anything (ip="10.0.0.0/8" OR ip="192.168.0.0/16" OR ip="172.16.0.0/12") | eval bu=(network="network_name1", "bu1", network="network_name2", "bu2",network="network_name3", "bu3",network="network_name4", "bu4")| stats dc(ip) by bu
Thanks!